panic: vop_gWeAnRNerIiNcG_:b adSoPpL NOSTt LoOppWeEdR atED ON SYSCALL 73 536870912 EXIT 0 a db_enter+0x1c: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND 300448 61678 32767 0x10 0x4000000 0 syz-executor.3 *505595 45812 32767 0x10 0 1K syz-executor.6 db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff8288c3b1) at panic+0x17b sys/kern/subr_prf.c:198 vop_generic_badop(ffff80002bc75af8) at vop_generic_badop+0x1f sys/kern/vfs_default.c:133 VOP_STRATEGY(fffffd806b859cb0,fffffd8064338c18) at VOP_STRATEGY+0x9f sys/kern/vfs_vops.c:628 bwrite(fffffd8064338c18) at bwrite+0x1d0 sys/kern/vfs_bio.c:757 VOP_BWRITE(fffffd8064338c18) at VOP_BWRITE+0x4e sys/kern/vfs_vops.c:640 ufs_mkdir(ffff80002bc75d70) at ufs_mkdir+0x445 sys/ufs/ufs/ufs_vnops.c:1165 VOP_MKDIR(fffffd8066e7d568,ffff80002bc75ed0,ffff80002bc75f00,ffff80002bc75e00) at VOP_MKDIR+0xc3 sys/kern/vfs_vops.c:388 domkdirat(ffff80002a17d810,ffffff9c,7142f1093e40,1ff) at domkdirat+0x125 sys/kern/vfs_syscalls.c:3077 syscall(ffff80002bc76080) at syscall+0x53b mi_syscall sys/sys/syscall_mi.h:183 [inline] syscall(ffff80002bc76080) at syscall+0x53b sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7142f1093eb0, count: 4 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic *cpu1: vop_generic_badop ddb{1}> trace db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff8288c3b1) at panic+0x17b sys/kern/subr_prf.c:198 vop_generic_badop(ffff80002bc75af8) at vop_generic_badop+0x1f sys/kern/vfs_default.c:133 VOP_STRATEGY(fffffd806b859cb0,fffffd8064338c18) at VOP_STRATEGY+0x9f sys/kern/vfs_vops.c:628 bwrite(fffffd8064338c18) at bwrite+0x1d0 sys/kern/vfs_bio.c:757 VOP_BWRITE(fffffd8064338c18) at VOP_BWRITE+0x4e sys/kern/vfs_vops.c:640 ufs_mkdir(ffff80002bc75d70) at ufs_mkdir+0x445 sys/ufs/ufs/ufs_vnops.c:1165 VOP_MKDIR(fffffd8066e7d568,ffff80002bc75ed0,ffff80002bc75f00,ffff80002bc75e00) at VOP_MKDIR+0xc3 sys/kern/vfs_vops.c:388 domkdirat(ffff80002a17d810,ffffff9c,7142f1093e40,1ff) at domkdirat+0x125 sys/kern/vfs_syscalls.c:3077 syscall(ffff80002bc76080) at syscall+0x53b mi_syscall sys/sys/syscall_mi.h:183 [inline] syscall(ffff80002bc76080) at syscall+0x53b sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7142f1093eb0, count: -11 ddb{1}> show registers rdi 0 rsi 0x1 rbp 0xffff80002bc75a20 rbx 0xffff800029ceccb7 rdx 0 rcx 0xffff80002a17d810 rax 0xffff800029cebff0 r8 0x101010101010101 r9 0x8080808080808080 r10 0x6f926be758be2461 r11 0xba5405133937c14b r12 0xffff800029cecab8 r13 0 r14 0 r15 0x1 rip 0xffffffff811bf67c db_enter+0x1c cs 0x8 rflags 0x246 rsp 0xffff80002bc75a10 ss 0x10 db_enter+0x1c: addq $0x8,%rsp ddb{1}> show proc PROC (syz-executor.6) tid=505595 pid=45812 tcnt=1 stat=onproc flags process=10 proc=0 runpri=17, usrpri=83, slppri=17, nice=20 wchan=0x0, wmesg=, ps_single=0x0 forw=0xffffffffffffffff, list=0xffff80002a17dab8,0xffff80002a230d48 process=0xffff8000ffff2c78 user=0xffff80002bc71000, vmspace=0xfffffd80755c1e20 estcpu=36, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0 ddb{1}> ps PID TID PPID UID S FLAGS WAIT COMMAND 93341 246809 96820 32767 2 0x10 syz-executor.1 93341 283136 96820 32767 3 0x4000090 fsleep syz-executor.1 93341 75736 96820 32767 3 0x4000090 fsleep syz-executor.1 61678 148430 10748 32767 2 0x10 syz-executor.3 61678 313880 10748 32767 3 0x4000090 kqread syz-executor.3 61678 344123 10748 32767 3 0x4000010 vmmaplk syz-executor.3 61678 300448 10748 32767 7 0x4000010 syz-executor.3 *45812 505595 64246 32767 7 0x10 syz-executor.6 64246 258767 94296 0 3 0x82 wait syz-executor.6 7903 137567 15807 32767 2 0x10 syz-executor.0 15807 1777 94296 0 3 0x82 wait syz-executor.0 85120 346989 1 32767 2 0x10 syz-executor.5 10748 499275 97934 32767 3 0x90 nanoslp syz-executor.3 97934 368257 94296 0 3 0x82 wait syz-executor.3 56357 392270 30275 32767 3 0x10 biowait syz-executor.7 30275 93847 94296 0 3 0x82 wait syz-executor.7 13332 240518 0 0 3 0x14200 bored sosplice 91776 373834 1 32767 2 0x10 syz-executor.4 96820 105748 76099 32767 3 0x90 nanoslp syz-executor.1 98638 126569 1 32767 2 0x10 syz-executor.2 76099 414177 94296 0 3 0x82 wait syz-executor.1 94296 196814 85505 0 2 0x1a000082 syz-fuzzer 94296 393133 85505 0 3 0x1e000082 nanoslp syz-fuzzer 94296 457577 85505 0 3 0x1e000082 thrsleep syz-fuzzer 94296 463312 85505 0 3 0x1e000082 wait syz-fuzzer 94296 19059 85505 0 2 0x1e000082 syz-fuzzer 94296 359262 85505 0 3 0x1e000082 thrsleep syz-fuzzer 94296 245456 85505 0 3 0x1e000082 thrsleep syz-fuzzer 94296 31920 85505 0 3 0x1e000082 wait syz-fuzzer 94296 331491 85505 0 3 0x1e000082 wait syz-fuzzer 94296 453512 85505 0 3 0x1e000082 thrsleep syz-fuzzer 94296 170316 85505 0 3 0x1e000082 thrsleep syz-fuzzer 94296 232311 85505 0 3 0x1e000082 thrsleep syz-fuzzer 94296 156293 85505 0 3 0x1e000082 wait syz-fuzzer 94296 201186 85505 0 3 0x1e000082 thrsleep syz-fuzzer 94296 194985 85505 0 3 0x1e000082 thrsleep syz-fuzzer 94296 206172 85505 0 3 0x1e000082 wait syz-fuzzer 85505 163428 4421 0 3 0x810008a sigsusp ksh 4421 492007 24492 0 2 0x1800009a sshd 33203 235741 1 0 3 0x18100083 ttyin getty 24492 508701 1 0 3 0x18000088 kqread sshd 16298 155835 9932 73 3 0x19100090 kqread syslogd 9932 45794 1 0 3 0x18100082 netio syslogd 51822 59851 1 0 3 0x18100080 kqread resolvd 27277 328828 83911 77 3 0x18100092 kqread dhcpleased 56720 418414 83911 77 3 0x18100092 kqread dhcpleased 83911 506958 1 0 3 0x18000080 kqread dhcpleased 15482 421803 0 0 3 0x14200 bored smr 34854 194814 0 0 2 0x14200 zerothread 25658 240333 0 0 3 0x14200 aiodoned aiodoned 43124 5360 0 0 3 0x14200 syncer update 85652 573 0 0 3 0x14200 cleaner cleaner 52589 340153 0 0 3 0x14200 reaper reaper 49589 523927 0 0 3 0x14200 pgdaemon pagedaemon 39497 403549 0 0 3 0x14200 bored viomb 49002 284976 0 0 3 0x40014200 acpi0 acpi0 70463 4983 0 0 3 0x40014200 idle1 96344 58669 0 0 3 0x14200 bored softnet3 48152 449554 0 0 3 0x14200 bored softnet2 56530 211923 0 0 3 0x14200 bored softnet1 68614 449160 0 0 3 0x14200 bored softnet0 20184 70216 0 0 3 0x14200 bored systqmp 16345 42353 0 0 3 0x14200 bored systq 40665 28038 0 0 3 0x14200 tmoslp softclockmp 97229 369348 0 0 3 0x40014200 tmoslp softclock 6337 222522 0 0 3 0x40014200 idle0 1 429801 0 0 3 0x8000082 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{1}> show all locks CPU 0: exclusive mutex &pmap->pm_mtx r = 0 (0xfffffd80668836d8) #0 witness_lock+0x446 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x446 sys/kern/subr_witness.c:1187 #1 mtx_enter_try+0x103 #2 mtx_enter+0x4e sys/kern/kern_lock.c:266 #3 pmap_do_remove+0x99 rcr3 machine/cpufunc.h:141 [inline] #3 pmap_do_remove+0x99 pmap_map_ptes sys/arch/amd64/amd64/pmap.c:425 [inline] #3 pmap_do_remove+0x99 sys/arch/amd64/amd64/pmap.c:1800 #4 uvm_unmap_kill_entry_withlock+0x1b1 sys/uvm/uvm_map.c:1928 #5 uvm_unmap_remove+0x4c7 sys/uvm/uvm_map.c:2067 #6 sys_munmap+0x1a3 sys/uvm/uvm_mmap.c:532 #7 syscall+0x5b5 mi_syscall sys/sys/syscall_mi.h:183 [inline] #7 syscall+0x5b5 sys/arch/amd64/amd64/trap.c:577 #8 Xsyscall+0x128 Process 61678 (syz-executor.3) thread 0xffff80002a249d50 (300448) uvm_fault(0xfffffd80755c1e20, 0x0, 0, 1) -> e kernel: page fault trap, code=0 Faulted in DDB; continuing... ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 10218 6413K 6419K 166960K 11343 0 pcb 15 14K 16K 166960K 19 0 rtable 242 6K 7K 166960K 1468 0 pf 29 8K 8K 166960K 59 0 ifaddr 44 15K 15K 166960K 108 0 ifgroup 50 2K 2K 166960K 110 0 sysctl 3 0K 1K 166960K 7 0 counters 64 36K 36K 166960K 94 0 ioctlops 0 0K 2K 166960K 115 0 iov 0 0K 16K 166960K 481 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1364 86K 86K 166960K 2663 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 9K 166960K 91 0 VM map 2 1K 1K 166960K 2 0 sem 12 0K 0K 166960K 1306 0 dirhash 12 2K 2K 166960K 69 0 ACPI 1697 195K 286K 166960K 12548 0 file desc 17 61K 125K 166960K 5791 0 sigio 0 0K 0K 166960K 287 0 proc 56 78K 103K 166960K 1280 0 subproc 104 6K 6K 166960K 299 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 702 0 in_multi 99 7K 7K 166960K 309 0 ether_multi 1 0K 0K 166960K 10 0 mrt 1 0K 0K 166960K 1 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 289 1288K 1288K 166960K 289 0 exec 0 0K 1K 166960K 1625 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 348 83K 89K 166960K 58955 0 UVM aobj 131 4K 4K 166960K 133 0 pinsyscall 22 44K 100K 166960K 1689 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 122 0 NDP 13 0K 2K 166960K 72 0 temp 74 6812K 6892K 166960K 17891 0 kqueue 14 20K 30K 166960K 631 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 24 0 0 1 0 1 1 0 8 0 rtpcb 120 451 0 448 4 3 1 3 0 8 0 rtentry 112 287 0 173 4 0 4 4 0 8 0 unpcb 144 4544 0 4530 45 44 1 6 0 8 0 syncache 336 61 0 61 9 8 1 1 0 8 1 sackhl 24 4 0 4 2 2 0 1 0 8 0 tcpqe 32 949 0 949 8 7 1 1 0 8 1 tcpcb 808 2443 0 2434 57 55 2 10 0 8 0 arp 120 50 0 32 1 0 1 1 0 8 0 ipq 40 3 0 3 3 3 0 1 0 8 0 ipqe 40 11 0 11 3 3 0 1 0 8 0 inpcb 392 5320 0 5308 83 74 9 24 0 8 6 nd6 136 78 0 50 2 0 2 2 0 8 0 kcovpl 48 23 0 15 1 0 1 1 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 1140 0 678 31 2 29 30 0 8 0 art_table 32 1141 0 678 4 0 4 4 0 8 0 art_node 16 286 0 182 1 0 1 1 0 8 0 sysvmsgpl 40 3 0 3 1 1 0 1 0 8 0 semapl 112 1304 0 1294 1 0 1 1 0 8 0 shmpl 112 130 0 2 4 0 4 4 0 8 0 dirhash 1024 55 0 38 3 0 3 3 0 8 0 dino2pl 256 9153 0 7634 96 0 96 96 0 8 0 ffsino 272 9153 0 7634 103 0 103 103 0 8 0 nchpl 144 16725 0 15003 66 0 66 66 0 8 0 uvmvnodes 80 5926 0 0 121 0 121 121 0 8 0 vnodes 216 5926 0 0 330 0 330 330 0 8 0 namei 1024 56862 0 56859 8 7 1 2 0 8 0 percpumem 16 61 0 15 1 0 1 1 0 8 0 kstatmem 264 52 0 30 2 0 2 2 0 8 0 scxspl 216 61545 0 61544 31 28 3 8 1 8 2 plimitpl 152 573 0 552 5 4 1 2 0 8 0 sigapl 424 6054 0 6007 7 0 7 7 0 8 0 futexpl 64 46455 0 46453 4 3 1 1 0 8 0 knotepl 120 414 0 0 8 0 8 8 0 8 0 kqueuepl 216 1553 0 1544 27 26 1 5 0 8 0 pipepl 320 1287 0 1259 36 33 3 8 0 8 0 fdescpl 496 6035 0 6007 7 2 5 6 0 8 0 filepl 152 37769 0 37533 63 52 11 20 0 8 1 lockfpl 104 1393 0 1391 2 1 1 2 0 8 0 lockfspl 48 378 0 376 1 0 1 1 0 8 0 sessionpl 144 38 0 22 1 0 1 1 0 8 0 pgrppl 48 211 0 195 1 0 1 1 0 8 0 ucredpl 104 6114 0 6096 1 0 1 1 0 8 0 zombiepl 144 6007 0 6007 1 0 1 1 0 8 1 processpl 1136 6054 0 6007 5 0 5 5 0 8 0 procpl 680 16249 0 16182 14 6 8 9 0 8 1 sosppl 168 118 0 118 9 8 1 1 0 8 1 sockpl 584 10607 0 10578 100 92 8 23 0 8 5 mcl64k 65536 17 0 0 3 0 3 3 0 8 0 mcl16k 16384 15 0 0 2 0 2 2 0 8 0 mcl12k 12288 25 0 0 2 0 2 2 0 8 0 mcl9k 9216 17 0 0 2 0 2 2 0 8 0 mcl8k 8192 25 0 0 3 0 3 3 0 8 0 mcl4k 4096 25 0 0 3 0 3 3 0 8 0 mcl2k2 2112 8 0 0 1 0 1 1 0 8 0 mcl2k 2048 316 0 0 35 5 30 35 0 8 0 mtagpl 96 3 0 0 1 0 1 1 0 8 0 mbufpl 256 6772 0 0 410 0 410 410 0 8 0 bufpl 280 14904 0 8642 448 0 448 448 0 8 0 anonpl 24 809526 0 798504 174 78 96 103 0 186 1 amapchunkpl 152 186144 0 185373 63 24 39 45 0 158 2 amappl16 200 21531 0 21125 131 98 33 40 0 8 8 amappl15 192 39 0 38 2 1 1 1 0 8 0 amappl14 184 193 0 182 2 1 1 2 0 8 0 amappl13 176 5 0 5 1 1 0 1 0 8 0 amappl12 168 6895 0 6864 2 0 2 2 0 8 0 amappl11 160 71 0 61 1 0 1 1 0 8 0 amappl10 152 58 0 48 1 0 1 1 0 8 0 amappl9 144 281 0 280 1 0 1 1 0 8 0 amappl8 136 388 0 293 4 0 4 4 0 8 0 amappl7 128 106 0 89 1 0 1 1 0 8 0 amappl6 120 555 0 535 2 1 1 2 0 8 0 amappl5 112 360 0 348 1 0 1 1 0 8 0 amappl4 104 793 0 753 2 0 2 2 0 8 0 amappl3 96 36473 0 36400 7 4 3 5 0 8 0 amappl2 88 6802 0 6728 4 2 2 4 0 8 0 amappl1 80 30220 0 29720 23 10 13 22 0 8 0 amappl 88 58077 0 57866 7 0 7 7 0 92 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 132 0 2 3 0 3 3 0 8 0 uaddrrnd 24 6035 0 6007 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 6035 0 6007 1 0 1 1 0 8 0 vmmpekpl 168 50783 0 50729 4 0 4 4 0 8 0 vmmpepl 168 378372 0 376164 232 109 123 146 0 357 4 vmsppl 448 6034 0 6007 5 0 5 5 0 8 0 rwobjpl 56 108107 0 100630 115 5 110 111 0 8 0 pdppl 4096 12077 0 12014 322 245 77 95 0 8 14 pvpl 32 44910 0 0 363 0 363 363 0 265 0 pmappl 248 6034 0 6007 4 1 3 3 0 8 0 extentpl 40 56 0 38 1 0 1 1 0 8 0 phpool 112 1208 0 422 24 1 23 24 0 8 0 ddb{1}> machine ddbcpu 0 Stopped at x86_ipi_db+0x1e: addq $0x8,%rsp x86_ipi_db(ffffffff82ce2ff0) at x86_ipi_db+0x1e sys/arch/amd64/amd64/db_interface.c:393 x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 alltraps_kern_meltdown() at alltraps_kern_meltdown+0x68 savectx() at savectx+0xae end of kernel end trace frame: 0xfd83bef0890, count: 10 ddb{0}> trace x86_ipi_db(ffffffff82ce2ff0) at x86_ipi_db+0x1e sys/arch/amd64/amd64/db_interface.c:393 x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 alltraps_kern_meltdown() at alltraps_kern_meltdown+0x68 savectx() at savectx+0xae end of kernel end trace frame: 0xfd83bef0890, count: -5 ddb{0}> machine ddbcpu 1 Stopped at db_enter+0x1c: addq $0x8,%rsp db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff8288c3b1) at panic+0x17b sys/kern/subr_prf.c:198 vop_generic_badop(ffff80002bc75af8) at vop_generic_badop+0x1f sys/kern/vfs_default.c:133 VOP_STRATEGY(fffffd806b859cb0,fffffd8064338c18) at VOP_STRATEGY+0x9f sys/kern/vfs_vops.c:628 bwrite(fffffd8064338c18) at bwrite+0x1d0 sys/kern/vfs_bio.c:757 VOP_BWRITE(fffffd8064338c18) at VOP_BWRITE+0x4e sys/kern/vfs_vops.c:640 ufs_mkdir(ffff80002bc75d70) at ufs_mkdir+0x445 sys/ufs/ufs/ufs_vnops.c:1165 VOP_MKDIR(fffffd8066e7d568,ffff80002bc75ed0,ffff80002bc75f00,ffff80002bc75e00) at VOP_MKDIR+0xc3 sys/kern/vfs_vops.c:388 domkdirat(ffff80002a17d810,ffffff9c,7142f1093e40,1ff) at domkdirat+0x125 sys/kern/vfs_syscalls.c:3077 syscall(ffff80002bc76080) at syscall+0x53b mi_syscall sys/sys/syscall_mi.h:183 [inline] syscall(ffff80002bc76080) at syscall+0x53b sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7142f1093eb0, count: 4 ddb{1}> trace db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff8288c3b1) at panic+0x17b sys/kern/subr_prf.c:198 vop_generic_badop(ffff80002bc75af8) at vop_generic_badop+0x1f sys/kern/vfs_default.c:133 VOP_STRATEGY(fffffd806b859cb0,fffffd8064338c18) at VOP_STRATEGY+0x9f sys/kern/vfs_vops.c:628 bwrite(fffffd8064338c18) at bwrite+0x1d0 sys/kern/vfs_bio.c:757 VOP_BWRITE(fffffd8064338c18) at VOP_BWRITE+0x4e sys/kern/vfs_vops.c:640 ufs_mkdir(ffff80002bc75d70) at ufs_mkdir+0x445 sys/ufs/ufs/ufs_vnops.c:1165 VOP_MKDIR(fffffd8066e7d568,ffff80002bc75ed0,ffff80002bc75f00,ffff80002bc75e00) at VOP_MKDIR+0xc3 sys/kern/vfs_vops.c:388 domkdirat(ffff80002a17d810,ffffff9c,7142f1093e40,1ff) at domkdirat+0x125 sys/kern/vfs_syscalls.c:3077 syscall(ffff80002bc76080) at syscall+0x53b mi_syscall sys/sys/syscall_mi.h:183 [inline] syscall(ffff80002bc76080) at syscall+0x53b sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7142f1093eb0, count: -11